IOTA once used Winternitz OTS — a hash-based, quantum-aware signature scheme. Then in Stardust/Shimmer, it switched to Ed25519 and became Shor-vulnerable. BMIC implements NIST FIPS 203, 204, and 205 with no one-time key limitations and no backwards steps.
Join the BMIC Presale →IOTA's original Tangle used Winternitz OTS — a hash-based scheme with quantum-aware properties. But W-OTS required one-time keys, creating address-reuse vulnerabilities that led to real-world theft. The Stardust redesign replaced W-OTS with Ed25519 — trading quantum awareness for UX convenience. IOTA is now Shor-vulnerable. BMIC uses NIST FIPS 203/204/205 — reusable wallets, no one-time key limitation, quantum-safe from genesis.
IOTA is unique in the blockchain space: it is the only major project that started with a quantum-aware signature scheme and then downgraded to a quantum-vulnerable one. Understanding this history is essential to evaluating IOTA's current security posture.
In its current production form (Stardust protocol), IOTA uses Ed25519 over Curve25519 — identically to Stellar, Waves, Algorand, and Solana. Ed25519 is broken by Shor's algorithm. The quantum-aware W-OTS heritage of IOTA 1.x is not present in the active production system. IOTA has no published post-quantum cryptography roadmap for Stardust as of October 2026.
Understanding W-OTS helps clarify why "quantum-aware" in IOTA 1.x was a meaningful but impractical property.
Winternitz OTS is a hash-based signature scheme. Its security relies on the hardness of inverting a cryptographic hash function. Shor's algorithm attacks the discrete logarithm problem and integer factorisation — it does not break hash functions. Grover's algorithm provides a quadratic speedup against hash functions, which is mitigated by doubling the output size (e.g., SHA-256 becomes effectively 128-bit security against Grover — still adequate).
This is why W-OTS was quantum-aware: an adversary with a CRQC running Shor's algorithm gains no advantage against a properly sized hash-based signature scheme.
W-OTS has a critical practical limitation: each key pair is safe to use exactly once. Signing two messages with the same W-OTS key pair reveals enough private key material for an attacker to forge signatures. In IOTA 1.x:
IOTA faced a genuine dilemma: keep W-OTS (quantum-aware but one-time keys → real-world theft risk) or switch to Ed25519 (reusable keys, better UX, classical security but quantum-vulnerable). They chose UX over quantum safety. This was a defensible product decision but it means IOTA is no longer quantum-aware in production. BMIC avoided this dilemma by using ML-DSA (FIPS 204) — a lattice-based signature scheme that is both reusable and quantum-safe.
| Attribute | BMIC | IOTA (Current: Stardust) | IOTA (Legacy: 1.x W-OTS) |
|---|---|---|---|
| Signature Algorithm | ML-DSA (FIPS 204) | Ed25519 | W-OTS (hash-based) |
| Quantum-Aware | Yes (NIST PQC) | No | Yes (hash-based) |
| Reusable Keys/Addresses | Yes | Yes (Ed25519) | No (one-time only) |
| Broken by Shor's Algorithm | No | Yes | No |
| Real-World Exploit History | None | None so far | Yes (address reuse theft) |
| NIST PQC Standardised | Yes (FIPS 203/204/205) | No | No (pre-NIST PQC era) |
| PQC Roadmap Published | Yes | None as of Oct 2026 | N/A |
| Key Encapsulation | ML-KEM (FIPS 203) | None (ECDH-equivalent) | N/A |
| HNDL Window | 0 years | 3+ years (Stardust era) | 2016–2022 (W-OTS era) |
| TGE / Network Type | Q4 2026 (ERC-4337) | DAG / Tangle (live) | DAG (deprecated) |
IOTA's dilemma — quantum-aware W-OTS with one-time keys vs. Ed25519 with reusable addresses — illustrates the limitations of pre-NIST post-quantum approaches. BMIC chose NIST-standardised algorithms that solve both problems simultaneously:
SLH-DSA (FIPS 205) is NIST's hash-based scheme — the spiritual successor to W-OTS. Unlike W-OTS, SLH-DSA is stateless: it does not require tracking which key pairs have been used, and addresses are safely reusable without leaking private key material. BMIC uses ML-DSA as the primary signature scheme and SLH-DSA as the hash-based backup — getting the quantum safety of hash-based cryptography without W-OTS's one-time limitation.
BMIC operates via ERC-4337 account abstraction on Ethereum. PQC signature verification is enforced at the smart contract level, meaning BMIC users get quantum-safe wallets without waiting for Ethereum's base-layer cryptographic migration. The architecture is compatible with Ethereum's existing ecosystem while providing post-quantum security today.
IOTA 1.x used Winternitz OTS — a hash-based signature scheme. Hash-based signatures are quantum-aware: Shor's algorithm does not apply to hash functions; Grover's algorithm provides only a quadratic speedup, mitigated by doubling key size. So yes, IOTA 1.x had a meaningful quantum-aware property. However, W-OTS required one-time keys, which led to address-reuse exploits and real-world theft. The quantum safety came at an unacceptable UX and security cost in practice.
No. IOTA's current production protocol (Stardust) uses Ed25519 over Curve25519 — broken by Shor's algorithm. The quantum-aware W-OTS from IOTA 1.x is no longer deployed in production. IOTA has no published PQC migration roadmap for Stardust as of October 2026.
W-OTS required one-time keys: each address could only safely sign once. Users who forgot this or who received funds to a spent address were vulnerable to key leakage and theft. Real-world MIOTA theft resulted. The Stardust redesign chose Ed25519 for reusability, standard tooling, and classical security — a defensible product choice that traded away quantum-awareness for UX safety. This is a unique and ironic story in crypto: a project that moved backwards on quantum safety to fix a classical security problem.
BMIC uses ML-DSA (FIPS 204) as its primary signature scheme — a lattice-based algorithm that is both quantum-safe and reusable. There is no one-time key limitation. BMIC also includes SLH-DSA (FIPS 205) as a stateless hash-based backup, which provides the quantum-safety properties of W-OTS without its stateful one-time limitation. BMIC gets the best of both worlds: reusable addresses and quantum safety.
BMIC launched its presale at $0.0528542. Price rises through phases. Visit bmic.ai for the current phase price. $662,646+ raised, TGE Q4 2026. DYOR — not investment advice.
No. The DAG/Tangle structure is a ledger architecture, not a cryptographic security mechanism. Quantum vulnerability derives from the signature scheme used to authorise transactions, not from whether those transactions are stored in a chain or a DAG. Both architectures are equally dependent on the underlying signature algorithm for security. IOTA's current Ed25519 signatures are equally Shor-vulnerable on a DAG as they would be on a chain.
IOTA chose between quantum safety and reusable keys. BMIC chose both — NIST FIPS 203/204/205 with reusable wallets and no migration required. Presale live at bmic.ai.
Join the BMIC Presale at bmic.ai →